SECURITY Signal 523
Encrypted AI reasoning traces can be decrypted by passing them to weaker models from the same provider
↗
Illustration only Photo by Konstantin Evdokimov on Unsplash
Researchers demonstrated that encrypted chain-of-thought reasoning blocks returned by LLM APIs are interchangeable across models within a provider's ecosystem, enabling attackers to decrypt them by injecting them into weaker, less-guarded models from the same provider.
This undermines the IP protection and safety mechanisms providers built into their reasoning trace encryption. Developers sharing session logs publicly are inadvertently exposing PII and credentials hidden inside encrypted blocks they cannot inspect, and systems processing untrusted blocks are vulnerable to invisible prompt injection.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Encrypted reasoning blocks from Anthropic, OpenAI, and Google are fully compatible and interchangeable across sessions, users, and models within each provider's ecosystem.
Injecting an encrypted trace from a stronger model into a weaker, less safeguarded model from the same provider forces the weaker model to decode and output the trace verbatim in plaintext.
Scraping and decoding 315,320 encrypted reasoning blocks from public repositories yielded 367 PII artifacts and 182 credentials.
THE CLUSTER